lemana-vpn/docs/goals/startup-dns-and-icons/GOAL.md

Goal: Recover stale VPN DNS and ship the approved icons

Use Krypton Execution on docs/goals/startup-dns-and-icons/PLAN.md. Preserve user work and auth behavior. Root owns privileged DNS logic and integration; the icon agent has an explicitly disjoint write scope. Prove recovery using synthetic journal/process/DNS fixtures, never real network changes. Report unrun native/reboot acceptance and snapshotless legacy limits.

Result — 2026-10-08

Implemented in source. Normal installation updates the root helper and ships the native icon renderer. The app gates connection on a capability-checked startup recovery, displays failures/external sessions, and retries through Refresh. CLI exit replaces its finished process before recovery, retaining the client's exit code. DNS snapshots are data-only, versioned, private, durable and serialized with native lockf; no arbitrary private-address reset remains.

PRE review passed after adding unresolved-journal retention, shared locking and verified owner ancestry. Post-review fixes cover Bash pipeline/progress siblings and custom DNS on newly enabled network services. Final integration review: no outstanding blockers.

Automated evidence:

• python3 tests/dns_recovery.py: all 16 cases passed; subsequent focused competing-engine regression under the same CLI also passed. Original helper replay fails the new reboot recovery contract as expected.
• python3 tests/dns_cli.py: noninteractive command, legacy helper rejection, fixed JSON, path quoting and preserved client exit codes passed.
• python3 tests/menu.py and python3 tests/icons.py: startup lifecycle, fake CLI, real session timing, both icon themes and offscreen pixel checks passed.
• tests/smoke.sh, python3 tests/configuration.py, python3 tests/auth_settings.py, python3 tests/logging.py, and the installed openconnect-lite Python running tests/yandex_import.py: passed.
• Shell syntax, git diff --check and swift build -c release --package-path app: passed.

Real installation, app/GUI launch, live VPN/DNS changes and actual reboot acceptance were not run. Snapshotless pre-upgrade DNS must first be restored to the user's normal settings; no software can infer an unrecorded custom value. Other network locations, deleted services or invalid journals fail visibly and preserve the record.